Linux Kernel Media Component Vulnerability Affecting Vivid Driver

CVE-2025-38226

What is CVE-2025-38226?

A vulnerability in the Linux kernel's vivid media driver allows for a vmalloc-out-of-bounds condition. The issue arises during memory operations in the v4l2-tpg-core.c file, specifically when the composition size exceeds expected limits. This flaw can lead to unexpected behaviors and potential system instability. Proper validation checks are necessary to ensure that the composition size does not exceed the fmt_cap_rect size, which could trigger further memory-related issues.

References